Not sure if this will fix the issue since the email we got referred to access token being passed as a query param and this deal with basic auth (client id and client secret), but I couldn't find anything else that used token auth that didn't go through Octokit.
We got an email saying that query params for API calls were deprecated (related https://developer.github.com/changes/2020-02-10-deprecating-auth-through-query-param/#deprecation-timeline). It was fixed for basic auth in https://github.com/octokit/octokit.rb/pull/1192, which was released as part of Octokit v4.16.0.
Not sure if this will fix the issue since the email we got referred to access token being passed as a query param and this deal with basic auth (client id and client secret), but I couldn't find anything else that used token auth that didn't go through Octokit.